This letter responds to an individual who has requested the erasure of data relating to them. This letter confirms that the employer is willing to comply with the request but they need additional time due to the complexity of the information requested.

This letter responds to an individual who has requested the erasure of data relating to them. This letter confirms that the employer is willing to comply with the request but they need further information.

This letter responds to an individual who has requested the erasure of data relating to them. This letter confirms that the employer has completed this request.

This letter responds to an individual who has requested their data is rectified. This letter refuses the request as it is either excessive or unfounded.

This letter can be sent to a data subject who has requested that incorrect data in relation to them is rectified. This letter requests further information on the data to permit the employer to complete the request.

This letter can be sent to a data subject to inform them that their request to have data that was incorrect rectified is complete

The employer is not normally permitted to charge a fee for a SARS request. However, if the request is manifestly unfounded or repetitive they may charge a fee.

This letter is responding to a subject access request informing the data subject that the employer will comply with the request however, as the request is complex the employer will need more time.

This letter is responding to a subject access request informing the data subject that the employer will comply with the request however, as the request is complex the employer will need more information.

This letter responds to a subject access request and provides a copy of the information that is held and also lets the data subject know how it is processed

This data protection retention schedule outlines the duration for which varying categories of personal data will be held, the purpose of the processing, the format by which it is stored and the legal basis for processing this data.

This policy outlines how an organisation deals personal data and explains the organisation’s approach to making a subject access request, and how the organisation ensures compliance with General Data Protection Regulation (GDPR) in relation to the handling of personal data in this regard.

This privacy notice should be given to all employees. It outlines how and why the organisation collects and processes personal data relating to employees medical records data in line with GDPR and the Data Protection Act 2018.

This privacy notice should be available to all contractors. This policy outlines how the organisation will collect and process an applicants data in line with GDPR and the Data Protection Act 2018.

This policy sets out the organisation’s approach to processing special category personal data and criminal records data. It supplements the organisation’s data protection policy.

This policy outlines the employers responsibilities in dealing with Data in the workplace in line with GDPR and the Data Protection Act 2018.

This clause should be inserted into a contract of employment. This clauses informs an employee how their information Is processes.

This clause can be inserted into a contract of employment when employer monitors the communication structures within the organisation.

This letter can be sent to an employee’s GP when the employer has obtained consent from the employee to contact the GP directly to obtain a medical opinion on the employee.

This letter can be sent to an employee when an employer wishes to obtain their consent to access a medical report on the employee. This letter should be sent to accompany the Consent form to obtain a medical report.

This form can be used to request consent of a job applicant to continue to hold their personal information on file. This form should only be used when the employer has no other legitimate reason for processing the information. For example an employer will have a legal basis to process an unsuccessful job applicants details for a year in order to be able to defend any future claims from an unsuccessful applicant. If the employer wishes to process their information after this period of time they will need to seek consent.

This form seeks consent of former employees for the employer to process data in relation to the employee. This form should only be completed when consent can be relied upon and there is no other legitimate basis under GDPR that the employer has for processing the employee’s information.

This form seeks consent of new employees for the employer to process data in relation to the employee. This form should only be completed when consent can be relied upon and there is no other legitimate basis under GDPR that the employer has for processing the employee’s information.

This form seeks consent of existing employees for the employer to process data in relation to the employee. This form should only be completed when consent can be relied upon and there is no other legitimate basis under GDPR that the employer has for processing the employee’s information.

This form seeks consent from an employee for the employer to contact the employee’s GP or an independent medical professional for the purposes of obtaining a medical report on the employee.

This guide provides information on how an employer can remain compliant with data protection

This form should be completed by an individual who wishes to have data erased about them. This form requests the employee to let the employer know the reasons for the deletion, the data to be deleted and any supporting information.

This form should be completed by individuals who wish to have incorrect data in relation to them rectified. This form outlines the data the employee wishes to have rectified and what they request it is amended to.

This form should be completed by an individual who wishes to complete a SARS. This form outlines the information the employee requests and who they should return the form too.

This letter responds to an individuals request for erasure of their data refusing the request. The letter outlines the reasons for refusal such as the request is excessive or manifestly unfounded.